CVE-2025-26487

High · 8.6

CVSS

8.6

EPSS

0.3%

Published

Dec 8, 2025

CISA due date

—

The record

Server-Side Request Forgery (SSRF) vulnerability in Infinera MTC-9 version allows remote unauthenticated users to gain access to other network resources using HTTPS requests through the appliance used as a bridge.

Affected packages

Ecosystem	Package	Introduced	Fixed